Sub of epic #17018 — the implementation-substrate half of AC-C, split from #17023 per the formal cycle-2 review of PR #17029 (mirrors the #17024 → #17034 split shape). #17023 keeps ownership of the live all-reader outcome: the reader-quiescence actuator, its four witnesses, and the executed transition evidence.
Live latest-open sweep: checked latest 20 open issues at 2026-08-12T18:36Z; nearest neighbors are #17023 (the retained outcome leaf) and #17034 (the parallel election-runner substrate split) — no equivalent. A2A in-flight claim sweep (status all, limit 30, herd window): no competing claim on this scope; the split itself was prescribed to this seat by the PR #17029 cycle-2 review.
Context
PR #17029 delivered a durable election record with identity/epoch/window fencing, a shared physical mount, a five-collection census, and election-gated promote primitives — and its cycle-2 review (PRR on PR #17029, cycle-2 closure comment) established that these primitives are genuinely repaired while the DEFINING #17023 property (no mixed reads at the reader boundary) requires an actuator that stops reader admission, drains, and holds a gate across the transition. That actuator belongs to the rebuild/transition controller, not to the primitive substrate. Closing #17023 on the primitives would erase its still-open outcome; leaving the PR without a truthful close target violates the ready-PR contract. This leaf owns exactly the bounded primitive substrate the PR delivers.
The Problem
Any embedding-generation change invalidates every vector across five live collections served by two services and one daemon. Before these primitives existed there was no durable plane-singleton authority, no writer fence, no per-collection receipt/completion tracking, and no crash-safe promote path for the two collections without a service seam. Those primitives are prerequisites for BOTH remaining AC-C deliverables (the actuator in #17023, the canonical-scale runner in #17025) and are independently reviewable and mergeable.
The Architectural Reality
ai/services/shared/vector/generationElectionStore.mjs — the plane-singleton record: lifecycle accepted → candidate → committed → accepted with rolled-back abort arm; epoch bumps only on visibility flips; commit/rollback REQUIRE a declared quiesce window {scope, startedAt, boundMs} and transition renames refuse outside it (renewTransitionQuiesce = the receipted stall remediation); fail-safe polarity (missing → legacy-grandfathered, corrupt/tampered → promotes refuse while readers stay untouched); seven-coordinate identity refusing placeholders and requiring digest-bearing model references.
ai/services/shared/vector/electionGatedPromote.mjs — runner-owned two-rename promote/un-park for the seamless collections (mc.temporalSummary, mc.graph) with the fence immediately before renames and crash-rollback between them.
Both service seams gated: VectorService.embedViaShadowSwap (view captured before build, fence before renames) and restoreTargetSetStorage (per-attempt views).
One physical mount: shared-vector-generation-data into kb-server/mc-server/orchestrator, with a static spec tying the compose literal to the store resolver.
Health: KB + MC healthchecks report vectorGeneration (elected + parked identities, active window, per-collection state).
The Fix
PR #17029 retargets to resolve THIS leaf. Three review-identified primitive-level repairs land on the PR before merge (they are this leaf's delta ACs):
Restart reconciliation for an interrupted promote — a SIGKILL between the two renames leaves parking present + canonical absent, and the current precondition refuses the retry; the resume path must reconcile instead of dead-ending the collection.
Window re-check immediately before the second rename — shrinking the unobserved expiry gap to a single rename.
Election view captured at STAGING start per restore attempt — an election landing during staging must fence the stale build; first-promote capture is too late.
Contract Ledger
The ledger on #17023 (backfilled 2026-08-12) governs these primitives verbatim; this leaf delivers its identity, record, receipt, completion, and health rows. The actuator row ("the deployment enforces the quiet") explicitly remains #17023's.
Acceptance Criteria
The election record, fences, quiesce contract, five-key census, and identity hardening are delivered with the store fixture suite green (lifecycle, both fence coordinates, window expiry + renewal, rollback semantics, tamper/corrupt polarity).
The physical halt/crash matrix runs real renames on name-resolving collections and reads every canonical name after each transition step, including the crash-between-renames restoration arm.
Restart reconciliation: a promote interrupted between renames (parking present, canonical absent) resumes on retry instead of refusing — fixture included.
The quiesce window is re-checked immediately before the second rename — fixture for expiry between renames.
The restore seam captures its election view at staging start per attempt — fixture for an election landing during staging.
One shared election mount across kb-server, mc-server, and the orchestrator, with the static drift spec green.
KB/MC healthchecks report elected + parked identities and the active window.
Out of Scope
The reader-quiescence actuator, concurrent-reader witness, process-kill witnesses at scale, and the executed transition — #17023 (open).
The resumable, budgeted canonical-scale rebuild runner and its receipts — #17025.
The cutover packaging and external revision — #17026 / AC-D stage 5.
Decision Record impact
aligned-with ADR-0014 (as amended by #17019/PR #17020); ADR-0019 obeyed (no new config leaf; entrypoints read resolved leaves at use sites).
Sub of epic #17018 — the implementation-substrate half of AC-C, split from #17023 per the formal cycle-2 review of PR #17029 (mirrors the #17024 → #17034 split shape). #17023 keeps ownership of the live all-reader outcome: the reader-quiescence actuator, its four witnesses, and the executed transition evidence.
Live latest-open sweep: checked latest 20 open issues at 2026-08-12T18:36Z; nearest neighbors are #17023 (the retained outcome leaf) and #17034 (the parallel election-runner substrate split) — no equivalent. A2A in-flight claim sweep (status all, limit 30, herd window): no competing claim on this scope; the split itself was prescribed to this seat by the PR #17029 cycle-2 review.
Context
PR #17029 delivered a durable election record with identity/epoch/window fencing, a shared physical mount, a five-collection census, and election-gated promote primitives — and its cycle-2 review (PRR on PR #17029, cycle-2 closure comment) established that these primitives are genuinely repaired while the DEFINING #17023 property (no mixed reads at the reader boundary) requires an actuator that stops reader admission, drains, and holds a gate across the transition. That actuator belongs to the rebuild/transition controller, not to the primitive substrate. Closing #17023 on the primitives would erase its still-open outcome; leaving the PR without a truthful close target violates the ready-PR contract. This leaf owns exactly the bounded primitive substrate the PR delivers.
The Problem
Any embedding-generation change invalidates every vector across five live collections served by two services and one daemon. Before these primitives existed there was no durable plane-singleton authority, no writer fence, no per-collection receipt/completion tracking, and no crash-safe promote path for the two collections without a service seam. Those primitives are prerequisites for BOTH remaining AC-C deliverables (the actuator in #17023, the canonical-scale runner in #17025) and are independently reviewable and mergeable.
The Architectural Reality
ai/services/shared/vector/generationElectionStore.mjs— the plane-singleton record: lifecycleaccepted → candidate → committed → acceptedwithrolled-backabort arm; epoch bumps only on visibility flips; commit/rollback REQUIRE a declared quiesce window{scope, startedAt, boundMs}and transition renames refuse outside it (renewTransitionQuiesce= the receipted stall remediation); fail-safe polarity (missing → legacy-grandfathered, corrupt/tampered → promotes refuse while readers stay untouched); seven-coordinate identity refusing placeholders and requiring digest-bearing model references.ai/services/shared/vector/electionGatedPromote.mjs— runner-owned two-rename promote/un-park for the seamless collections (mc.temporalSummary,mc.graph) with the fence immediately before renames and crash-rollback between them.VectorService.embedViaShadowSwap(view captured before build, fence before renames) andrestoreTargetSetStorage(per-attempt views).shared-vector-generation-datainto kb-server/mc-server/orchestrator, with a static spec tying the compose literal to the store resolver.vectorGeneration(elected + parked identities, active window, per-collection state).The Fix
PR #17029 retargets to resolve THIS leaf. Three review-identified primitive-level repairs land on the PR before merge (they are this leaf's delta ACs):
Contract Ledger
The ledger on #17023 (backfilled 2026-08-12) governs these primitives verbatim; this leaf delivers its identity, record, receipt, completion, and health rows. The actuator row ("the deployment enforces the quiet") explicitly remains #17023's.
Acceptance Criteria
Out of Scope
Decision Record impact
aligned-with ADR-0014 (as amended by #17019/PR #17020); ADR-0019 obeyed (no new config leaf; entrypoints read resolved leaves at use sites).
Related
Epic #17018 · #17023 (retained outcome leaf; becomes blocked_by this leaf) · #17025 (consumes these primitives) · #17034 (the parallel substrate/outcome split) · PR #17029 (retargets here) · D#17015 r6 (AC-C)
Origin Session ID: 8637b4b9-b852-45d9-b057-de34184aae8b Retrieval Hint: "vector generation election primitives quiesce window gated promote shared mount"